Information Security Engineer III

Software Guidance & Assistance, Inc. (SGA) is seeking a Lead Information Security Engineer for a remote contract position supporting a financial services client. The role will build, operate, and continuously improve an LLM-based code vulnerability detection capability using AWS Bedrock, CI/CD pipelines, Terraform, ECS, GitHub, Jenkins, and Splunk, while providing rotating 24/7 operational support.

Responsibilities:

• Implement and operate an LLM-based code vulnerability detection capability on AWS Bedrock, including prompt/agent implementation, model invocation patterns, cost and token controls, and result normalization
• Build and maintain the evaluation harness used to measure scanner quality, including regression corpora, repeatable test execution, and reporting on detection performance over time
• Build and maintain scanning pipelines integrated with GitHub and Jenkins, deployed to ECS and provisioned through Terraform
• Deliver findings and operational telemetry into Splunk; build dashboards and alerting for scanner health, coverage, and throughput
• Engineer and implement well-architected solutions while adhering to software development best practices
• Design, test, and implement solutions at the Story and Feature level within an established architecture
• Contribute to the development and maintenance of standards, procedures, runbooks, and guidelines necessary to satisfy the Information Security department's operations
• Provide ongoing operational support, patching, and defect resolution for the deployed scanner after go-live
• Participate in a four-person rotating shift schedule providing 24/7 coverage, including nights, weekends, and holidays. Scheduled hours average 40 per week
• Monitor scanner health, pipeline execution, and alert queues during assigned shift; execute documented runbooks and escalate per established procedures
• Perform structured shift handoff, including documentation of open issues, in-flight changes, and outstanding escalations
• Maintain appropriate controls and documentation to ensure compliance with all company and regulatory requirements
• Understand virtualization/containerization technologies

Requirements:

• Candidates must reside in the US
• • 2+ years of related engineering experience, including hands-on information security or software development work
• • Exposure to AWS Bedrock or equivalent hosted LLM platforms, including model invocation and guardrail configuration
• • Working knowledge of Infrastructure as Code best practices and ability to build and modify Terraform modules
• • Experience working within CI/CD pipelines, preferably Jenkins, integrated with GitHub
• • Familiarity with application security concepts, common vulnerability classes, and SAST/SCA tooling behavior
• • Able to communicate technical status, risks, and blockers clearly in writing and verbally to technical peers and leadership
• • Willingness and availability to work an assigned shift within a rotating 24/7 schedule, including nights, weekends, and holidays
• • Able to work independently during off-hours shifts with limited direct supervision
• • Hands-on experience building on AWS, including IAM, ECS, and service-to-service authentication patterns
• • Hands-on experience with AWS Bedrock, including model selection and inference optimization
• • Experience with agentic or multi-step LLM workflows, including context management across large repositories
• • Experience with RESTful APIs and event-driven architectures
• • Splunk development experience, including data onboarding, search, and dashboarding
• • Experience with containerized workloads and Linux systems
• • Prior experience supporting a 24/7 operational environment, including shift handoff and runbook execution
• • Experience working in Agile methodologies and development
• • Prior experience in a regulated financial services environment
• • Industry standard certifications such as AWS Solutions Architect Associate, AWS Security Specialty, or CompTIA Security+